WIXLIB

Technical Proposal Template for Huawei USG660033 Network Security Requirements of XX EnterpriseNetwork Security Requirements of XXEnterprise[This chapter briefs and analyzes the network security problems of XX enterprise. Thoroughcommunication with the customer and our analysis reveal that XX enterprise requires networkattack defense, security zone division, and NAT ]3.1 Network Security Design Principles for XX EnterpriseBased on the requirements of enterprise XX for network security and Huawei experience innetwork security, we propose that the network security design of XX enterprise must stick tothe following principles:1.Advancement: Security devices deployed in XX enterprise network must use thededicated hardware platform and secure and professional software platform to ensuredevice security, which conforms to the technology development trend in aspect ofadvancement and maturity in the industry.2.High availability: The network of XX enterprise is the basis for informatization of theenterprise and therefore is of vitality. Deployed at key nodes, network security devicesplay important roles in network stability. High availability must be considered during thenetwork design.3.Scalability: The fast development of XX enterprise and its changing network require thatthe entire network be flexible and scalable, especially for new security zones andsecurity zone expansion.4.Compatibility: The design standards and technical specifications of XX enterprise'ssecurity products comply with international and industry standards. XX enterprise'ssecurity products are compatible with products from many peer vendors, which helpsXX enterprise maximize return on investment (ROI).5.Minimum authorization: Security policy management of XX enterprise must complywith the minimum authorization principle. To be specific, hosts in given security zonescan access only authorized resources. Resources in XX enterprise must be under controland are inaccessible to unauthorized terminals to secure the enterprise.Huawei Proprietary and ConfidentialCopyright Huawei Technologies Co., Ltd.5

Technical Proposal Template for Huawei USG66003 Network Security Requirements of XX Enterprise3.2 Network Security Requirements of XX EnterpriseDeploy a gateway to satisfy the following requirements of XX enterprise (list the requirementsbased on the network problems and analysis of XX enterprise):1.Security zone division: assign the financial department, R&D department, marketingdepartment, and production department to different security zones.2.Network attack defense: enable network attack defense at the network egress to preventattacks from extranets and between security zones to prevent spreading of networkattacks among different departments. ]Huawei Proprietary and ConfidentialCopyright Huawei Technologies Co., Ltd.6

Technical Proposal Template for Huawei USG660044 Huawei Network Security SolutionHuawei Network Security Solution4.1 Network Security Solution for XX EnterpriseChoose one solution or a combination of solutions based on the analysis of XX enterprise'srequirements.4.1.1 Border Protection for Large and Medium-sized EnterprisesFigure 4-1 Typical networking of border protection for large and medium-sized enterpriseseSightFile server Mail server Web serverVPN tunnelDMZMobileemployeeVPN tunnelOfficenetworkBranchofficeUSGs thatimplement hotstandbyTrustUntrustPublicnetwork/serverLarge and medium-sized enterprises have following service features: Large number of employees (over 500), complex services, and various flows Services available to external users, such as website and mail services Exposure to DDoS attacks and great losses after the attacks succeedHuawei Proprietary and ConfidentialCopyright Huawei Technologies Co., Ltd.7

Technical Proposal Template for Huawei USG6600 4 Huawei Network Security SolutionHigh requirements on device reliability for service continuity when traffic is heavy oreven the device is faultyThe USGs that act as egress gateways of a large and medium-sized enterprise provide thefollowing functions: Assign the employee network, server network, and Internet into different security zonesand configure security policies to inspect the traffic transfer between security zones. Implement the content security defense function based on the services to be provided toexternal users. For example, file blocking and data filtering are enabled on the file serverin the preceding figure, mail filtering is enabled on the mail server, and antivirus andintrusion prevention are enabled on all servers. Implement URL filtering, file blocking, data filtering, antivirus, and application behaviorcontrol to defend against Internet threats and prevent information leaks, which ensuresnetwork security. Establish VPN tunnels with the devices of mobile employees and branch offices forsecure communication with the headquarters across the Internet. Implement the anti-DDoS function to defend against heavy-traffic attacks launched byextranet hosts, which ensures the normal operating of services. Apply bandwidth policies to traffic between the intranet and extranet to control thebandwidth and number of connections, which avoids network congestion and defendsagainst DDoS attacks. Communicate with the eLog server (to be purchased independently) that records logsabout network operating. The logs help administrators adjust configurations, identifyrisks, and audit traffic. Implement hot standby to improve system availability. When a single-point fault occurs,service traffic can be smoothly switched from the active device to the standby device toensure continuity.Huawei Proprietary and ConfidentialCopyright Huawei Technologies Co., Ltd.8

Technical Proposal Template for Huawei USG66004 Huawei Network Security Solution4.1.2 Intranet Control and Security IsolationFigure 4-2 Typical networking of intranet control and security artmentProductionServer areaServerR&Ddepartment 1USGEgressgatewayR&Ddepartment 2ResearchUntrustIntrazone trafficInterzone trafficSecurity levels are assigned to the subnets of the intranet of a large or medium-sizedenterprise. For example, the USG isolates the R&D network, production network, andmarketing network and monitors traffic among the networks to: Take different security measures for the service types and security risks of the networks. Control traffic among the networks to avoid information leaks. Isolate networks to prevent the spread of viruses. Divide networks to reduce the detection load and improve the detection efficiency fornetwork connectivity because most traffic is generated within one network and the trafficwithin one network does not require much intervention.The USG that acts as an intranet border device of a large and medium-sized enterpriseprovides the following functions: Isolates networks. Establishes a user management system to control user access permissions. Assigns the networks of the same security level to the same security zone. A few securityfunctions are deployed. For example, R&D networks 1 and 2 belong to security zoneResearch, and the packet filtering, blacklist and whitelist, and antivirus functions can beapplied to the traffic transmitted between the two networks. Assigns networks of different security levels to different security zones. Securityfunctions are deployed based on actual service requirements. For example, only someR&D hosts can access the marketing network, and the antivirus, file blocking, and datafiltering functions are applied between the R&D network and the marketing, production,and server networks.Huawei Proprietary and ConfidentialCopyright Huawei Technologies Co., Ltd.9

Technical Proposal Template for Huawei USG66004 Huawei Network Security Solution Applies bandwidth policies to security zones to control the bandwidth and number ofconnections to avoid intranet congestion. Applies intrusion prevention, antivirus, file blocking, data filtering, URL filtering, andapplication behavior control functions between security zones and the Internet.4.1.3 Border Protection for IDCsFigure 4-3 Border protection for IDCsNMS andlog serverDMZHackerWeb serverMail serverFile serverIndividualcustomerUSGs thatimplementhot standbyTrustUntrustEnterprisecustomerInternet Data Center (IDC) is an infrastructure that involves maintenance services to collect,store, process, and send data on the Internet. The IDC is generally constructed by a networkserver provider to provide the server hosting and virtual domain name services for small andmedium-sized enterprises and individual customers.The network structure of the IDC has the following features: Servers in the IDC are protected and security functions are applied based on servicetypes. Servers of multiple enterprises may be deployed in an IDC and are easily taken byhackers as a target. The key function of the IDC is to provide network services for external users. Thenormal access from the Internet to servers in the IDC must be guaranteed. In this case,the border protection device must have high processing policy and comprehensivereliability mechanism and ensure the network access when attacks are launched on theIDC. The IDC traffic is complex. The administrator cannot adjust configurations effectively ifthe traffic is not unclear.The USGs that act as border devices of the IDC provide the following functions: Implement the traffic statistics function to collect statistics on traffic by IP address, users,or application, which helps formulate security policies.Huawei Proprietary and ConfidentialCopyright Huawei Technologies Co., Ltd.10

Technical Proposal Template for Huawei USG66004 Huawei Network Security Solution Implement traffic limit by IP address or application to ensure the stable operating ofservers and avoid network congestion. Implement the intrusion prevention and antivirus functions to protect servers fromviruses, Trojan horses, and worms. Implement anti-DDoS and other attack defense functions to defend against attacks fromthe Internet. Implement the mail filtering function to protect mail servers on the intranet from thespam and prevent the servers from being blacklisted by anti-spam organizations due tounintentional spam forwarding. Implement file blocking and data filtering to prevent information leaks. Communicate with the eLog server (to be purchased independently) that records logsabout network operating. The logs help administrators adjust configurations, identifyrisks, and audit traffic. Implement hot standby to improve system availability. When a single-point fault occurs,service traffic can be smoothly switched from the active device to the standby device toensure continuity.4.1.4 VPN Remote Access and Mobile WorkingFigure 4-4 Typical networking of VPN remote access and mobile workingSSL VPNBranchofficeHeadquartersIPSecUSGUSGPartnerL2TP over IPSecUSGNowadays, enterprises generally establish branch offices or cooperate with remoteorganizations around the world. Branch offices, partners, and mobile employees need toremotely access the headquarters. The secure and low-cost remote access and mobile workingcan be implemented using VPN technologies. Remote access and mobile working have thefollowing features: Branch offices need to access the headquarters network seamlessly and implementoperations uninterruptedly. Partners must be flexibly authorized to limit the accessible network resources andtransmittable data types based on services. The locations, IP addresses, and access time of mobile employees are unfixed. Inaddition, mobile employees are not protected by information security measures. Strictaccess authentication must be implemented on mobile employees, and their accessibleresources and permissions must be accurately controlled.Huawei Proprietary and ConfidentialCopyright Huawei Technologies Co., Ltd.11

Technical Proposal Template for Huawei USG6600 4 Huawei Network Security SolutionEncryption protection must be implemented on data of remote access communications toprevent network eavesdropping, tampering, forgery, and replay as well as informationleaks on the application and content planes.The USGs that act as the access gateway of enterprise VPNs provide the following functions: Establish permanent IPSec or L2TP over IPSec tunnels for the branches and partnerswith fixed VPN gateways. If access account verification is required, L2TP over IPSectunnels are recommended. The VPN client or SSL VPN technologies are used by mobile employees with variableaddresses. The VPN client is for free. VPN client installation is not required. Mobileemployees can use only web browsers to establish tunnels with the headquarters, whichis convenient. Meanwhile, resources accessible to the mobile employees are controlled ina fine-grained manner. Apply the IPSec or SSL encryption algorithm to protect network data transmitted overtunnels. Implement access authentication on the users that access using VPN tunnels to ensureuser legitimacy and access authorization based on user permissions. Implement the intrusion prevention, antivirus, file filtering, data filtering, and anti-DDoSfunctions to prevent remote access users from introducing network threats as well asinformation leaks. Implement the user behavior audit function to discover risks in time for future tracking.4.1.5 Cloud Computing Gateway Protection SolutionFigure 4-5 Net

website, and web page chatting. 3. The packet content is uncertain. Single-packet detection mechanism can analyze only the security of individual packets. This mechanism cannot defend against viruses or Trojan horses during a normal access process. During the Internet access, intranet hosts may introduce worms, Trojan horses,